T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:13
- Finding
- Shell Command Injection Through LinkedIn Post Content## Vulnerability Details **File Location**: `SKILL.md`, lines 13-16 **Vulnerability Type**: Shell command injection through unsafe interpolation of user-controlled content **Risk Level**: High ### Vulnerable Code ```bash Jalankan script Python berikut dengan teks post sebagai argumen: ```bash python3 ~/.openclaw/workspace/linkedin_post.py "<isi post>" ``` ``` ### Technical Analysis The skill directs the agent to substitute user-controlled LinkedIn post text directly into a shell command enclosed in double quotes. Shell double quotes preserve command substitution constructs such as `$(command)` and backticks. Consequently, if the agent constructs and executes the documented command through a shell, specially crafted post content can cause commands to execute before `linkedin_post.py` receives its argument. Requiring user confirmation before posting does not neutralize this vulnerability. A user may confirm text containing a concealed or misunderstood shell expression, while shell evaluation occurs independently of the LinkedIn posting operation. The referenced `~/.openclaw/workspace/linkedin_post.py` file was not included in the audited project, so its behavior and security controls could not be verified. ### Attack Path 1. An attacker supplies LinkedIn post content containing a shell substitution expression, such as `$(malicious_command)`. 2. The agent asks for confirmation as required by the skill. 3. The attacker confirms the post. 4. The agent interpolates the content into the documented command: ```bash python3 ~/.openclaw/workspace/linkedin_post.py "Post text $(malicious_command)" ``` 5. A shell evaluates `$(malicious_command)` before launching Python. 6. The injected command executes with the operating-system privileges and environment available to the agent. 7. The resulting command output, if any, is inserted into the argument passed to the LinkedIn posting script, potentially obsc ...[truncated 605 chars]
- Remediation
- ## Remediation Suggestions - Do not construct a shell command by interpolating post text. - Invoke the Python interpreter directly through an argument-vector API with shell processing disabled. The conceptual invocation should be: ```text ["python3", "/absolute/path/to/linkedin_post.py", post_text] ``` - If the execution interface exposes a `shell` option, explicitly set it to `false`. - Use an absolute, trusted path for `linkedin_post.py` and verify that the script is controlled by the expected owner and is not writable by untrusted users. - Validate the post length as data, but do not rely on character filtering as the primary command-injection defense. - If a shell is unavoidable, apply robust platform-specific argument escaping. This is less reliable than avoiding the shell and should only be a fallback. - Update the skill documentation to explicitly state that user content must be passed as a literal process argument and must never be evaluated as shell syntax. - Add regression tests using content containing `$(...)`, backticks, quotes, semicolons, line breaks, and shell metacharacters, verifying that all content reaches the script literally and no secondary command is executed.